Pieces Protocol
First Flight #32
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The ERC20ToGenerateNftFraccion.sol::mint() function is public with no restrictions anyone can mint tokens

0xziin

Summary

The ERC20ToGenerateNftFraccion.sol::mint() function is public with no restrictions anyone can mint tokens.

Vulnerability Details

The ERC20ToGenerateNftFraccion.sol::mint() function is public with no restrictions anyone can mint the amount of tokens he wants to any address.

contract ERC20ToGenerateNftFraccion is ERC20, ERC20Burnable {
​
constructor(string memory _name, string memory _symbol) ERC20(_name, _symbol) {
​
}
​
function mint(address _to, uint256 _amount) public { // <- No restriction
_mint(_to, _amount);
}
}

Impact

Anyone can mint any amount he wants to anyone, creating huge inflation.

Tools Used

Manual review, Github.

Recommendations

Restrict the access of the mint() function. Only allowing the owner of the contract to be able to mint for example or just delete the minting function.
A first mint can be done through the contructor() and usually it is enough.

Updates

Lead Judging Commences

fishy Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of token access control chekcs

Any person can mint the ERC20 token generated in representation of the NFT

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.